General

Malware Config

Signatures

Files

• a79e50e75bb460b965145638b3ed120d2c86fb4ac606ef51bc3c4922cf0fe3e6

  .rar
• AllVideoSoundExtractor/HA_AllVideoSoundExtractor23_WGL.exe

  .exe windows x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 36KB - Virtual size: 35KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 1024B - Virtual size: 584B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 3KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 8B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 30KB - Virtual size: 30KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• AllVideoSoundExtractor/lpk.dll

  .dll windows x86

  78e397a561f0c355666a0cce61d5c812

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  ExitProcess

  GetProcAddress

  LoadLibraryW

  lstrcatW

  GetSystemDirectoryW

  FreeLibrary

  lstrcpynA

  LockResource

  LoadResource

  SizeofResource

  FindResourceW

  CreateProcessW

  CloseHandle

  WriteFile

  CreateFileW

  GetTempFileNameW

  GetTempPathW

  GetLastError

  CreateMutexA

  lstrcmpiW

  GetModuleFileNameW

  GetExitCodeProcess

  TerminateProcess

  WaitForSingleObject

  GetCurrentThreadId

  GetFileAttributesW

  lstrcpyW

  GetTickCount

  GetLogicalDrives

  FindNextFileW

  SetFileAttributesW

  CopyFileW

  FindClose

  FindFirstFileW

  WaitForMultipleObjects

  TerminateThread

  ResumeThread

  SetThreadPriority

  CreateThread

  SetEvent

  CreateEventW

  DisableThreadLibraryCalls

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCurrentProcess

  IsProcessorFeaturePresent

  IsDebuggerPresent

  user32

  wsprintfW

  shell32

  ord92

  ord64

  shlwapi

  PathRemoveFileSpecW

  StrStrIW

  PathAppendW

  PathFindExtensionW

  PathFindFileNameW

  SHRegGetValueW

  Exports

  Exports

  LpkDllInitialize

  LpkDrawTextEx

  LpkEditControl

  LpkExtTextOut

  LpkGetCharacterPlacement

  LpkGetTextExtentExPoint

  LpkInitialize

  LpkPSMTextOut

  LpkTabbedTextOut

  LpkUseGDIWidthCache

  ftsWordBreak

  Sections

  111

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .text

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 34KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 700B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ